CVE-2026-74740

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the tcf action exec() function when handling TC ACT GOTO CHAIN. The function performs an initial check of the a->goto chain pointer and subsequently calls tcf action goto chain exec(), which performs a second independent read of a->goto chain and dereferences chain->filter chain. If a concurrent tcf action set ctrlact() operation clears a->goto chain between these two reads, the second read returns NULL, leading to a NULL pointer dereference. TOCTOU is a software bug where a system checks the state of a resource before using it, but the state changes between the check and the use.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.